Ho provato ad eliminare totalmente strcpy, a questo punto se posso dargli un valore con malloc alla array multdimensionale uguale alla lunghezza del "tmp"... questa è la funzione, però non funziona:

codice:
#include <string.h>
#include <stdio.h>
#include <stdlib.h>

char** explode(char sep, char *prova);

int main (void)
{    
    char **new;
    
    new = explode(',', "-1,-1,2,3,5,6,7,8,9");
   
    return 0;
}

char** explode(char sep, char *prova) {
    int elem = 0, i = 0, i2 = 0;
    //char *prova = "-1,-1,2,3,5,6,7,8,9";
    char *tmp = NULL;
    char **ret = NULL;
    
    for (; i < strlen(prova); i++) {
        if (tmp != NULL) {
            tmp = (char *)realloc(tmp, (strlen(tmp) + 1) * sizeof(char));
        } else {
            tmp = (char *)malloc(1 * sizeof(char));
        }
        
        tmp[i] = *(prova+i);

        if (*(prova+i) == sep) {
            elem += 1;

            if (ret == NULL) {
                ret = (char **)malloc(elem * sizeof(char));
            } else {
                ret = (char **)realloc(ret, (strlen(*ret) + 1) * elem * sizeof(char));
            }
            
            ret[elem -1] = (char *)malloc(strlen(tmp) * sizeof(char));
            ret[elem -1] = tmp;
            
            /*for (; i2 < (strlen(tmp)-1); i2++) {
                strcpy(ret[elem - 1], tmp);
                
            }*/
            
            free(tmp);
            tmp = NULL;
            
        }
    }
    
    free(tmp);
    
    printf("\nElementi: %d\n", (elem+1));
    
    return ret;
}
Errore:
root@matias-desktop:/home/matias/Desktop# gcc try.c -o try
root@matias-desktop:/home/matias/Desktop# ./try
*** Error in `./try': realloc(): invalid next size: 0x000000000197a030 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7ffbdf84e7e5]
/lib/x86_64-linux-gnu/libc.so.6(+0x82a5a)[0x7ffbdf859a5a]
/lib/x86_64-linux-gnu/libc.so.6(realloc+0x179)[0x7ffbdf85ac89]
./try[0x40075f]
./try[0x40065d]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7ffbdf7f7830]
./try[0x400579]
======= Memory map: ========
00400000-00401000 r-xp 00000000 00:2c 4194365 /home/matias/Desktop/try
00600000-00601000 r--p 00000000 00:2c 4194365 /home/matias/Desktop/try
00601000-00602000 rw-p 00001000 00:2c 4194365 /home/matias/Desktop/try
0197a000-0199b000 rw-p 00000000 00:00 0 [heap]
7ffbd8000000-7ffbd8021000 rw-p 00000000 00:00 0
7ffbd8021000-7ffbdc000000 ---p 00000000 00:00 0
7ffbdf5bf000-7ffbdf5d5000 r-xp 00000000 08:04 10228185 /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffbdf5d5000-7ffbdf7d4000 ---p 00016000 08:04 10228185 /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffbdf7d4000-7ffbdf7d5000 rw-p 00015000 08:04 10228185 /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffbdf7d7000-7ffbdf996000 r-xp 00000000 08:04 10230132 /lib/x86_64-linux-gnu/libc-2.23.so
7ffbdf996000-7ffbdfb96000 ---p 001bf000 08:04 10230132 /lib/x86_64-linux-gnu/libc-2.23.so
7ffbdfb96000-7ffbdfb9a000 r--p 001bf000 08:04 10230132 /lib/x86_64-linux-gnu/libc-2.23.so
7ffbdfb9a000-7ffbdfb9c000 rw-p 001c3000 08:04 10230132 /lib/x86_64-linux-gnu/libc-2.23.so
7ffbdfb9c000-7ffbdfba0000 rw-p 00000000 00:00 0
7ffbdfba7000-7ffbdfbcd000 r-xp 00000000 08:04 10230133 /lib/x86_64-linux-gnu/ld-2.23.so
7ffbdfdca000-7ffbdfdcc000 rw-p 00000000 00:00 0
7ffbdfdcc000-7ffbdfdcd000 r--p 00025000 08:04 10230133 /lib/x86_64-linux-gnu/ld-2.23.so
7ffbdfdcd000-7ffbdfdce000 rw-p 00026000 08:04 10230133 /lib/x86_64-linux-gnu/ld-2.23.so
7ffbdfdce000-7ffbdfdd0000 rw-p 00000000 00:00 0
7ffbdfdd0000-7ffbdfdd3000 rw-p 00000000 00:00 0
7fff1cb0d000-7fff1cb2e000 rw-p 00000000 00:00 0 [stack]
7fff1cb47000-7fff1cb49000 r--p 00000000 00:00 0 [vvar]
7fff1cb49000-7fff1cb4b000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]
Aborted (core dumped)